<!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
        <title>XSS测试页面</title>
        <style>
            table.style {
                border: 1px solid #1c6eA4;
                background-color: #eeeeee;
                width: 90%;
                text-align: center;
                border-collapse: collapse;
            }
            table.style td,table.style th{
                border: 1px solid #aaaaaa;
                padding: 3px 2px;
            }
            table.style tbody td {
                font-size: 13px;
            }
            table.style thead {
                background: rgb(154, 236, 161);
                border-bottom: 2px solid #444444;
            }
            table.style thead th {
                font-size: 15px;
                height: 40px;
                font-weight: bold;
                color: #FFFFFF;
                border-left: 2px solid #D0E4F5;
            }
            table.style thead th:first-child {
                border-left: none;
            }
            .round {
                border: 2px solid #765942;
                border-radius: 10px;
                padding: 10px 10px 10px 10px;
            }
            .button-style {
                border-radius: 4px;
            }
        </style>
        <script>
            var url;
            var mode;
            var method;
            var post_data;
            var num_ifrs;
            var num_delay;

            var cur_ifr = 0;
            var cur_payload = 0;
            var process_interval;
            var selected_opt;
            var all_ifrs = [];
            //function init(){

            //}
            function runModeChanged(){
                var runmode = document.getElementById("runmode");
                var selected_opt = runmode.options[runmode.selectedIndex].value;
                var req_ifrs = document.getElementById("req_ifrs");
                var req_iframes_url = document.getElementById("req_ifrs_url");
                var req_iframes_data = document.getElementById("req_ifrs_data");
                if(selected_opt == "1"){
                    req_ifrs.style.display = "none";
                    req_iframes_url.style.display = "none";
                    req_iframes_data.style.display = "none";

                }else if(selected_opt == "2"){
                    req_ifrs.style.display = "";
                    req_iframes_url.style.display = "";
                    req_iframes_data.style.display = "";
                }
            }
            function createIfrs(num_iframes){
                all_ifrs = []
                ifrm = document.getElementById("runiframe");
                ifrm.innerHTML = "";

                for(var i=0;i<num_iframes;i++){
                    var iframe = document.createElement("iframe");
                    iframe.width = 160;
                    iframe.height = 160;
                    ifrm.appendChild(iframe);
                    all_ifrs.push(iframe);

                    if((i+1)%6 == 0){
                        var br = document.createElement("br");
                        ifrm.appendChild(br);

                    }
                }
            }
            function html_entities(str){

                return str.replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/'/g,"&apos;").replace(/"/g,"&quot;");
            }
            function processExecInBatches(arr_payload){
                cur_ifr = 0;
                if(cur_payload == arr_payload.length){
                    clearInterval(process_interval);
                    cur_payload = 0;
                    alert("测试完成!");
                    return;
                }
                createIfrs(num_ifrs);

                for(var i=0;i<arr_payload.length;i++){
                    if(cur_ifr == num_ifrs){
                        cur_ifr = 0;
                        break;
                    }
                    
                    if(selected_opt == "1"){
                        console.log(all_ifrs.length)
                        var doc = all_ifrs[cur_ifr++].contentWindow.document;
                        doc.open();
                        doc.write(arr_payload[i]);
                        doc.close();
                    }
                    else if(selected_opt == "2"){
                        if(method=="GET"){
                            all_ifrs[cur_ifr++].src = url.replace("[PAYLOAD]",escape(arr_payload[i]));

                        }else{
                        var form_content = '<form method="post" id="post_form" action="' +url + '">\n';
                        var params = post_data.split("&");
                        for(var p = 0; p < params.length; p++)
                        {
                            var each_param = params[p].split("=");
                            form_content += '<input type="hidden" name="' 
                                + html_entities(each_param[0].replace("[PAYLOAD]", html_entities(arr_payload[i]))) + '" value="' 
                                + html_entities(each_param[1].replace("[PAYLOAD]", html_entities(arr_payload[i]))) + '" />\n';
                        }
                
                        var doc = all_ifrs[cur_ifr++].contentWindow.document;
                        doc.open();
                        doc.write(form_content + '</form><scr' + 'ipt>document.getElementById(\'post_form\').submit();</scr' + 'ipt>\n');
                        doc.close();                            

                        }
                    }
                    cur_payload++;

                }

            }
            function processExec(arr_payload){
                var runmode = document.getElementById("runmode");
                selected_opt = runmode.options[runmode.selectedIndex].value;
                ifrm = document.getElementById("runiframe");
                num_ifrs = parseInt(document.getElementById("num_iframes").value);
                num_delay = parseInt(document.getElementById("ifr_delay").value);

                mode = document.getElementById("urlmode");
                method = mode.options[mode.selectedIndex].value;
                url = document.getElementById("get_url").value;
                if(arr_payload.length != num_ifrs){
                    num_ifrs = arr_payload.length;
                    document.getElementById("num_iframes").value = num_ifrs;
                }
                processExecInBatches(arr_payload);
                process_interval = setInterval(function(){
                    processExecInBatches(arr_payload);
                },num_delay);
                

            }
            function run(){
                var payloadstext = document.getElementById("payloads").value;
                var arr_payload = payloadstext.replace("\r\n","\n").split("\n");
                var output = document.getElementById("output");

                output.innerHTML = "<br />\r\n";
                document.getElementById("runiframe").innerHTML = "\r\n";
                if(arr_payload[0] != ""){
                    processExec(arr_payload);
                   
                }else{
                    alert("请输入有效载荷!")
                }
                
            }
        </script>
    </head>
    <body>
        <table class="style" align="center">
            <thead>
                <tr align="center">
                    <th colspan="3">
                        XSS模糊测试页面[FUZZ]
                    </th>
                </tr>
                <tr align="center">
                    <th colspan="3">
                        有效载荷[Payloads]
                    </th>
                </tr>
            </thead>
                <tr align="center">
                    <td colspan="3">
                        <textarea class="round" placeholder="有效载荷在这里编辑" id="payloads" rows="10" cols="80">&lt;script&gt;alert('xss')&lt;/script&gt;</textarea>
                    </td>
                </tr>
                <tr align="center">
                    <td>
                        <table>
                            <tr>
                                <td style="border: none;" width="80">
                                    运行模式:
                                </td>
                                <td style="border:none;" width="200">
                                    <select id="runmode" onchange="runModeChanged()">
                                        <option value="1">当前内联框架中测试</option>
                                        <option value="2">当前内联框架中运行GET/POST请求</option>
                                    </select>
                                </td>
                            </tr>
                            <tr id="run_nums_iframes" style="">
                                <td style="border:none">
                                    内联框数量:
                                </td>
                                <td style="border:none">
                                    <input type="text" id="num_iframes" style="width: 50px;" value="20" />
                                </td>
                            </tr>
                            <tr id="run_ifr_delay" style="">
                                <td style="border:none">
                                    显示延迟:
                                </td>
                                <td style="border:none">
                                    <input type="text" id="ifr_delay" style="width: 50px;" value="5000" />
                                </td>
                            </tr>
                            <tr id="req_ifrs" style="display: none;">
                                <td style="border:none">请求类型:  </td>
                                <td style="border:none">
                                    <select id="urlmode">
                                        <option value="GET">GET</option>
                                        <option value="POST">POST</option>
                                    </select>                                
                            </tr>
                            <tr id="req_ifrs_url" style="display: none;">
                                <td style="border:none">
                                    URL地址:
                                </td>
                                <td style="border:none">
                                    <input type="text" style="width: 300px;" id="get_url" value="http://" />
                                </td>
                            </tr>
        
                            <tr id="req_ifrs_data" style="display: none;">
                                <td style="border:none">POST 数据: </td>
                                <td style="border:none">
                                    <input type="text" style="width: 300px;" id="post_data" value="" />
                                </td> 
                            </tr>
                            <tr>
                                <td align="left" style="border: none; padding-left: 1px;" width="80">
                                    <input type="button" class="button-style" onclick="run()" value="运行"/>
                                </td>
                            </tr>
                        </table>
                    </td>                    
                </tr>
                <tr align="left">
                    <td colspan="3" style="padding-left: 20px;">
                        <br />输出: <br />
                        <div id="runiframe"></div><br />
                        <div id="output"></div>
                    </td>
                </tr>
        </table>
    </body>
</html>